One of the primary threats to DNN-based systems is adversarial examples (AEs), which are maliciously perturbed inputs to fool the DNN model [1]}. Defending against AEs has drawn lots of research interests from both academia and industry [2]}. Existing AE defense techniques can be broadly categorized into three types: (i) AE-aware training, including adversarial training techniques that incorporate perturbed inputs into the training set (e.g., [3]}, [4]}) and gradient masking/obfuscation techniques that try to construct models with gradients that are difficult to use by attackers (e.g., [5]}, [6]}). While effectively mitigating AE threats, such solutions not only are computationally expensive but also cause an undesirable decrease in the prediction accuracy of legitimate inputs [7]}, [8]}.
(ii). Input transformations, which "purifies" the inputs before feeding them into the DNN (e.g., [9]}, [10]}, [11]}). By doing so, carefully crafted adversarial perturbations are changed, thereby mitigating their abilities to attack.
Due to the nature of this technique, there is an inherent tradeoff between tolerable perturbations and prediction accuracy for clean inputs. Consequently, such solutions are usually only effective for AEs with small perturbations, and most of them are not resistant to adaptive attacks.
(iii). AE characterization, which detects AEs by leveraging the instability of AEs (e.g., [12]}, [13]}, [14]}, [15]}) or finding AEs as statistical outliers of all input samples (e.g., [16]}, [17]}, [18]}).
